> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# SonarQube

> Read quality gates, findings and hotspots through a server-side proxy.

Create a **User token** under **My Account → Security** on the intended SonarQube
instance. Prefer a dedicated service user with only the project read permissions
needed for the review; an analysis token is not a substitute for all Web API reads.

Open **Connectors → Connect → SonarQube** as an Administrator. Enter a label, the
instance URL and the user token. Nuphos validates it against that instance and
stores it encrypted. This connector does not upload source code for analysis.

## Use and verify

Select the binding and ask for one project's latest completed analysis and
Quality Gate. The agent can inspect code issues, vulnerability findings, Security
Hotspots and measures through the server-side proxy. Check the analysis date and
branch before treating a finding as a statement about the current code.

## Troubleshooting and removal

If an instance is unreachable, check URL reachability and the connection's URL
restrictions. If a project is missing, check the service user's project access.
Do not broaden the token to administrator just to bypass a missing read grant.
Remove the connection and revoke the token when ending access.

See [SonarQube token management](https://docs.sonarsource.com/sonarqube-server/2025.5/user-guide/managing-tokens).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.